something is corrupting the address stored in dev_priv->mmio.
i instrumented radeon_get_vblank_counter() and got this panic:
panic: ommio (0xffff8000062e5980) != dev_priv->mmio (0xffff8000062e5900)
and then it failed to enter ddb as usual, hinting that something
else is also corrupting the stack...
.mrg.